MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2c74260cce7798d2a4fdc7becc1e3e92e85c32f07ba096111062081fffc13fae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ConnectWise


Vendor detections: 14


Intelligence 14 IOCs YARA 15 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2c74260cce7798d2a4fdc7becc1e3e92e85c32f07ba096111062081fffc13fae
SHA3-384 hash: 0480fd4249b17dad53a6ec1888069cc3b7e5e51f4c07eab0e0803b4273944a86335cf2637a16ac6b53011c5b294df41b
SHA1 hash: abef0955ba8cb5faf082527d627d425e77045abd
MD5 hash: 84c73b03ab776e993a0b925e0433f13e
humanhash: maine-hot-colorado-skylark
File name:ScreenConnect.ClientSetup.exe
Download: download sample
Signature ConnectWise
Create hunting rule
File size:5'644'144 bytes
First seen:2026-06-15 08:43:19 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 9771ee6344923fa220489ab01239bdfd (511 x ConnectWise)
ssdeep 98304:0z3us6efPcIdoaxcp8wy5c3trGflkQ5DUOgJ9zl:0CfefPlHxcp9ym3WltDUJV
TLSH T11046E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6
TrID 29.5% (.EXE) Win64 Executable (generic) (6522/11/2)
22.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
20.3% (.EXE) Win32 Executable (generic) (4504/4/1)
9.1% (.EXE) OS/2 Executable (generic) (2029/13)
9.0% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter BlinkzSec
Tags:ConnectWise

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
TR TR
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
_2c74260cce7798d2a4fdc7becc1e3e92e85c32f07ba096111062081fffc13fae.exe
Verdict:
Malicious activity
Analysis date:
2026-06-15 08:50:48 UTC
Tags:
screenconnect tool rmm-tool remote
Link:
https://app.any.run/tasks/c8178ac4-6b49-47b7-a3f9-e4ddc32fdd48

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/70753/
Verdict:
Malicious
Score:
91.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a2fbb4ba15110463ee5f38b
Tags:
connectwise shellcode dropper crypted
Result
Verdict:
Malware
Maliciousness:

Behaviour
Connection attempt
Creating a file in the %temp% subdirectories
Launching a process
Creating a file
Creating a window
Сreating synchronization primitives
Searching for synchronization primitives
Loading a suspicious library
Deleting a recently created file
Modifying a system file
Creating a file in the Windows subdirectories
Creating a file in the Program Files subdirectories
Enabling autorun with the shell\open\command registry branches
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug base64 expired-cert invalid-signature microsoft_visual_cc overlay packed packed privilege reconnaissance revoked-cert signed
Link:
https://www.filescan.io/uploads/6a2fe2c90bddd27b6e070e2e/reports/57a7e98a-5e17-40ed-a28c-6aa10cef99e6/overview
Verdict:
Malicious
Labled as:
RiskWare[RemoteAdmin]/MSIL.ConnectWise
Link:
https://www.hybrid-analysis.com/sample/2c74260cce7798d2a4fdc7becc1e3e92e85c32f07ba096111062081fffc13fae
Malware family:
ConnectWise Inc
Create hunting rule
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/4833800c-ed8d-4b0d-94a5-1646e5e5058e
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/2c74260cce7798d2a4fdc7becc1e3e92e85c32f07ba096111062081fffc13fae
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2c74260cce7798d2a4fdc7becc1e3e92e85c32f07ba096111062081fffc13fae/
Verdict:
Malicious
Threat:
Family.SCREENCONNECT
Link:
https://tip.neiki.dev/file/2c74260cce7798d2a4fdc7becc1e3e92e85c32f07ba096111062081fffc13fae
Threat name:
Win32.Malware.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-06-15 08:20:53 UTC
File Type:
PE (Exe)
Extracted files:
174
AV detection:
17 of 36 (47.22%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fr2cmdgoo6mnfjh5y67myhr6slufymxqpoqjmeiqmieb776bh6xa._file
Verdict:
suspicious
Label(s):
admintool_screenconnect
Create hunting rule
Similar samples:
error
ConnectWise
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery ransomware revoked_codesign
Link:
https://tria.ge/reports/260615-kmxapahz6w/
Behaviour
Checks SCSI registry key(s)
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Program Files directory
Drops file in Windows directory
Enumerates connected drives
Checks computer location settings
Loads dropped DLL
Signed with revoked ConnectWise certificate
Unpacked files
SH256 hash:
2c74260cce7798d2a4fdc7becc1e3e92e85c32f07ba096111062081fffc13fae
MD5 hash:
84c73b03ab776e993a0b925e0433f13e
SHA1 hash:
abef0955ba8cb5faf082527d627d425e77045abd
Detections:
win_evilconwi_w0
Create hunting rule
triage_screenconnect_rat
Create hunting rule
Link:
https://www.unpac.me/results/fe52ff52-2ee4-42a9-aea4-2bd401b303e0/
SH256 hash:
8a55c15cc76e31042e17458c479772aa95bc1b908016c85b1dc8b8e3eff23254
MD5 hash:
decb1fd20d75e6eade9289cc24605f29
SHA1 hash:
5169602d641c4f2ebd9ca0639622949e00c25566
Link:
https://www.unpac.me/results/fe52ff52-2ee4-42a9-aea4-2bd401b303e0/
SH256 hash:
289a4eea79baa4141744e44d60db713e18b5f23322663c63047962f51b467614
MD5 hash:
48979a1a6d3badea8124bce04b1e01a5
SHA1 hash:
06931bd96343ce167eda796112a30ca8d9fa536a
Link:
https://www.unpac.me/results/fe52ff52-2ee4-42a9-aea4-2bd401b303e0/
SH256 hash:
319057c4014ab57060502eea0ace88606c52da7718f93eebdcf4120092403b02
MD5 hash:
a20da0875ac3c91eac5bb8af4696e3cf
SHA1 hash:
17f4b173176dad483f11684b7d199be36c3c46f3
Link:
https://www.unpac.me/results/fe52ff52-2ee4-42a9-aea4-2bd401b303e0/
SH256 hash:
8e7783dec955ee271d9d79c305a90dce1b4f2522948d4fe343fa63df7e37854d
MD5 hash:
f28a1bd8565a229baa2eed3a4188c4b2
SHA1 hash:
7496d48f61bd9ec47680eb804077b65f2175107d
Link:
https://www.unpac.me/results/fe52ff52-2ee4-42a9-aea4-2bd401b303e0/
SH256 hash:
19ac323ca6eae2f8145cdc2bac865b32cd5a48ad6ff199d4ca7da214b056e1dc
MD5 hash:
5fb6074b08ac4709cf2f29fa5b49023e
SHA1 hash:
8bbb78a47c08867c50572f0bd2a27171f91e0454
Link:
https://www.unpac.me/results/fe52ff52-2ee4-42a9-aea4-2bd401b303e0/
SH256 hash:
ad6062215032ab58369403b1221562b5e7fb5ae7d52b29b7fad69eefb2d8455b
MD5 hash:
723f2aaeeda1d2bb2f49322da349ffc9
SHA1 hash:
ac6ab994beaff69adf8a2dc480a8a628175ff6c8
Link:
https://www.unpac.me/results/fe52ff52-2ee4-42a9-aea4-2bd401b303e0/
SH256 hash:
1178ea9cb71451a4e5806aafc266a077c129d28940748fa1823db7803e66d442
MD5 hash:
753f5cdd7ada175e421f55f114c1e948
SHA1 hash:
b687d5d818aa2698b7605089047324b9bd690eb3
Link:
https://www.unpac.me/results/fe52ff52-2ee4-42a9-aea4-2bd401b303e0/
SH256 hash:
c21b341e9350038c8b1b875e848c694184cfa88d9570e6fd92f4448ad27bcf5c
MD5 hash:
5d404271c57ff9aae64b77515e573bdf
SHA1 hash:
bdeab92d1d16528d92a936a6d7051e679c5f2ac0
Link:
https://www.unpac.me/results/fe52ff52-2ee4-42a9-aea4-2bd401b303e0/
SH256 hash:
c218cccf182e0f31c69df65a283c7008621c6f5844122b9cda7cf86e8797dc62
MD5 hash:
2ca50942c5eb145cef87237c48d9b328
SHA1 hash:
cdd5cfe61bbd27b9a948909d67654d1359aa7f7e
Link:
https://www.unpac.me/results/fe52ff52-2ee4-42a9-aea4-2bd401b303e0/
SH256 hash:
9342c7be8036a5f8dc3895d75e3314dce961fd3bc70ee59928c67fa04f0c7e08
MD5 hash:
5419ff27205d3e5affa3fc18b811b843
SHA1 hash:
cf49072c50456381cd26cd32cb97606c5f5cfd26
Link:
https://www.unpac.me/results/fe52ff52-2ee4-42a9-aea4-2bd401b303e0/
SH256 hash:
2b3a903e3f879b7ce7428bc4a68766d5ca80c813d31590451d041335dabcce83
MD5 hash:
4cc33b476bc5f47ade447a4082984ef6
SHA1 hash:
d48bc03127e3b9023de6ef9f2ac01f05b066407f
Link:
https://www.unpac.me/results/fe52ff52-2ee4-42a9-aea4-2bd401b303e0/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2c74260cce7798d2a4fdc7becc1e3e92e85c32f07ba096111062081fffc13fae

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_EXE_DotNET_Encrypted
Create hunting rule
Author:ditekSHen
Description:Detects encrypted or obfuscated .NET executables
Rule name:INDICATOR_RMM_ConnectWise_ScreenConnect
Create hunting rule
Author:ditekSHen
Description:Detects ConnectWise Control (formerly ScreenConnect). Review RMM Inventory
Rule name:INDICATOR_RMM_ConnectWise_ScreenConnect_CERT
Create hunting rule
Author:ditekSHen
Description:Detects ConnectWise Control (formerly ScreenConnect) by (default) certificate. Review RMM Inventory
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:win_evilconwi_w0
Create hunting rule
Author:Karsten Hahn @ G DATA CyberDefense
Description:Settings from app.config that hide the connection of the client. These settings are potentially unwanted

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ConnectWise

Executable exe 2c74260cce7798d2a4fdc7becc1e3e92e85c32f07ba096111062081fffc13fae

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3864856/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/70753/

Comments